Hi, thanks for chiming in! Yes, it shows a different IP address other than the server, which means that they are spoofing. But, the weird thing is that the message header still shows @mydomain.com. So I am confuse as to how they are able to spoof it from another server but still have a valid...